The popular JavaScript package manager pnpm, already known for its speedy downloads, has further cut installation times by up to 90 percent thanks to a complete rewrite in Rust.Yet the freshly released version 12 of pnpm should not cause consternation while upgrading, its maintainer says.
“Upgrading should not feel like a migration. The commands, flags, settings, and lockfile format of pnpm 11 all carry over, and the documentation covers both versions,” wrote Zoltan Kochan, the current lead maintainer of pnpm.In the project’s own benchmarks, pnpm 12 installed a sample uncached package in 5.19 seconds, compared to the 8.22 seconds pnpm 11 required and the 47.7 seconds npm itself required.The project team also built a registry server in Rust, called pnpr, which improves performance even further. In the above test, the installation took only 3.37 seconds with pnpr on the backend.
A new Rust core binary, on which work started in April, eliminates a lot of the overhead that comes from routing filesystem work through Node.js. This new version is 65.9 percent Rust and 33.5 percent TypeScript, according to the GitHub stats. “Package installation is dominated by fetching metadata and tarballs, unpacking files, resolving dependency graphs, and linking packages into node_modules, making it a natural target for native code and parallelism,” wrote Sarah Gooding, vice president of communications for security provider Socket, in a blog post. Gooding also noted that the project benchmarked pnpm against Bun and Yarn, but the results were removed due to testing SNAFUs. Nonetheless, she noted the software cut install times by up to 90 percent in some cases.A faster npmDeveloper Rico Sta. Cruz originally created pnpm in 2016 as a faster alternative to npm (Node Package Manager), JavaScript’s de facto package manager, which devs used to find and download libraries and tools. GitHub acquired the open source npm software and repository in 2020.Npm garnered a reputation for being both sluggish and hungry for disk space, thanks to its generous practice of downloading all needed dependencies onto users’ machines, regardless of whether they were duplicates. Pnpm’s secret sauce is content-addressable storage. If you need a single library for 100 different applications, pnpm downloads it only once, and downloads another copy only if the developer specifies a different version.
